Technology Add-on Default Index other than Main

[aelliott]

I uploaded data into my system and created a TA that is CIM compliant.
I will be doing this for several sources, all that come from different indexes.
The issue I am having is that the queries in the app comes from several data models all that specify a sourcetype and no index, thus pulling from the default "main" index.
Is there a way to specify indexes to use for each type of add-on? or does anyone know a good solution to this issue?

[aivarson_splunk · Accepted solution]

You could always change the access controls for which indexes get searched by default. You can do this either by role or by user. In Version 6 you go to Settings, Access Controls, Pick Users or Role (whichever you want to modify) then scroll down to Indexes searched by default and add the ones you need. If you want to add them all just add All non-internal indexes to searchable. Then you can run a search like this to verify that the indexes are being searched without having to specify them: * | stats values(index)

[aelliott]

Thanks, I found this same answer and it worked! Here's my reference for anyone else wanting to do this.
http://docs.splunk.com/Documentation/ES/3.0/Install/ConfigureEnterpriseSecurity#Configure_multiple_i...